-2

Users can earn a privilege comment everywhere when their reputation reaches 50. Yes, I can comment on any questions or answers already. You can blame me for trying to test this.

On one question, I used FireBug plugin and tried to change the question ID (at least, I assume so). For instance:

        <div data-localized="true" class="comments dno" id="comments-xxxxxx">
        <table>
            <tbody data-addlink-disabled="false" data-addlink-html="add comment" data-remaining-comments-count="0">
                    <tr><td></td><td></td></tr>
            </tbody>
                <tfoot>
                    <tr>
                        <td></td>
                        <td class="comment-form">
                            <form data-placeholdertext="blah blah.." class="" id="add-comment-xxxxx"></form>
                        </td>
                    </tr>
                </tfoot>
        </table>
    </div>

Here xxxx must be changed to the same ID (the ID of a real answer or question). After I changed these to another post ID, I added comments. And indeed, this comment will be posted to that answer or question for which I inserted the ID. To see the comments, I opened the other question page with:

 http://stackoverflow.com/questions/xxxxx/

I am assuming that Stack Exchange doesn't validate comments on the server side.

I am correct? I am concerned about someone stupid using programattical means (for example, using HTML UNIT). Won't that lead to problems for Stack Exchange? Any explanation?

  • 1
    Sorry, what? I don't quite follow the issue here. – Oded Nov 1 '13 at 10:35
  • I am still noob in programming. so you can blame me for my stupid questions. – Cataclysm Nov 1 '13 at 10:35
  • 1
    I guess he's asking if comment-privilege validation only happens on the client-side @Oded ... – Bart Nov 1 '13 at 10:35
  • I'm somewhat unclear; are you saying it's possible to post comments without having the privaledge using this method? – Richard Tingle Nov 1 '13 at 10:36
  • I admit , I had tested like that just only one but now I deleted it. :) – Cataclysm Nov 1 '13 at 10:37
  • 1
    @RichardTingle - From the code, I think the OP is saying they can change the id attribute and post a comment on a different post, not on the current page. – Oded Nov 1 '13 at 10:37
  • Could you link to where you've used this to post a comment without having the privaledge? – Richard Tingle Nov 1 '13 at 10:38
  • @ Richard Tingle , no I mean I comment on question or answer A but that may post to question or answer B. – Cataclysm Nov 1 '13 at 10:40
  • @Cataclysm - Are you saying the problem is that it is possible to end up commenting on post X instead of post Y even if the UI belongs on post Y? – Oded Nov 1 '13 at 10:41
  • 2
    If so, can you explain why this is a problem? – Oded Nov 1 '13 at 10:41
  • 2
    @Cataclysm Is that a problem, if someone wants to post a comment on answer B and has the privileges to do so then thats fine. If they want to use a really mad way to achieve that then thats fine too – Richard Tingle Nov 1 '13 at 10:42
  • @ Richard Tingle, I described , programatically read them and add comments. – Cataclysm Nov 1 '13 at 10:43
  • 1
    @Cataclysm Ok, and what problem would that cause; reading comments is already officially possible by API and I believe writing comments will be soon as well (and I'm sure is unofficially possible already in a hundred different ways) – Richard Tingle Nov 1 '13 at 10:46
  • @Martijn Pieters , Thanks for your valuable edited to my question. Yes , I means as you edited. Sorry for my English. – Cataclysm Nov 1 '13 at 11:13
9

Yes, we do check if the logged in user has the permissions to comment on the server side.

We don't trust the client.


Now, you seem to be concerned about the ability to script a commenting bot of some sort - this is not an issue because comments are rate limited. We only allow commenting every 5 seconds.

Additionally, if enough comments by the same user get flagged, I believe a comment ban come into play.

So, this is a scenario we do handle.

  • I realize that.. when I asked this question stackoverflow.com/questions/17316550/…. If so, you need to handle from server site for this. – Cataclysm Nov 1 '13 at 10:39
  • 3
    For what? I still don't understand what the problem you are trying to describe is. – Oded Nov 1 '13 at 10:39
  • I mean I comment on question or answer A but that may post to question or answer B. – Cataclysm Nov 1 '13 at 10:42
  • 2
    @Cataclysm - Yes, I understand that. What I don't understand is why you think this is a problem. – Oded Nov 1 '13 at 10:44
  • I described , programatically read them and add comments. Can you think how many questions and answers ? – Cataclysm Nov 1 '13 at 10:45
  • 2
    @Cataclysm - First of all, you can only post a comment every 5 seconds. Second, if you post nonsense comments, they will get flagged and you would end up being banned (manually, by moderators). And all this is done server side. So - what exactly do you see to be a problem here? – Oded Nov 1 '13 at 10:46
  • Hmm... great ! I think wrong posting comments may worse things. – Cataclysm Nov 1 '13 at 10:49
  • "Yes, we do check if the logged in user has the permissions to comment on the server side." as you said . I know commenting on post need define reputations..OK ! why not this guy can do it ? – Cataclysm Nov 1 '13 at 10:51
  • Yes, finally , I accept your edited answer. Thanks for your valuable times. – Cataclysm Nov 1 '13 at 10:54
  • @Cataclysm - What guy? Where? A user can comment on their own post, always. If they asked a question, they can comment on the answers as well. – Oded Nov 1 '13 at 10:54
  • 1
    I've never heard of a comment ban. It was remotely mentioned here (in the first revision) but never really with proof it got implemented. Can you please check the codez and see if such thing exists? :) – Shadow Nov 1 '13 at 10:57
  • @ShaWizDowArd - I could be imagining things, based on discussions. – Oded Nov 1 '13 at 10:58
  • 1
    @ShaWizDowArd - No, it has not been implemented yet. – Oded Nov 1 '13 at 11:01
  • Yeah.. really ? I think as you described this has been implemented. :) – Cataclysm Nov 1 '13 at 11:06
  • 1
    @ShaWizDowArd - I don't think that any discussions made it far enough for a spec, let alone planning to do it. But "yet" means something may happen in the future ;) – Oded Nov 1 '13 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .